aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSimon McVittie <smcv@debian.org>2017-05-14 14:52:43 +0100
committerSimon McVittie <smcv@debian.org>2017-05-14 15:37:47 +0100
commit26ded176534a56ff93c464785aa446fb2f8c3cf7 (patch)
treeec751c87fdb8700c60e15e0960f5aac71efe9945
parent31c89db246a2e4704e3d4c3784c5406fbd084bb6 (diff)
downloadikiwiki-26ded176534a56ff93c464785aa446fb2f8c3cf7.tar
ikiwiki-26ded176534a56ff93c464785aa446fb2f8c3cf7.tar.gz
Defend against empty session names
If misconfiguration has resulted in an empty session name, treat the session as having not signed in.
-rw-r--r--IkiWiki/CGI.pm8
1 files changed, 4 insertions, 4 deletions
diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 1db96f9f2..d20a75923 100644
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -146,7 +146,7 @@ sub needsignin ($$) {
my $q=shift;
my $session=shift;
- if (! defined $session->param("name") ||
+ if (! length $session->param("name") ||
! userinfo_get($session->param("name"), "regdate")) {
$session->param(postsignin => $q->query_string);
cgi_signin($q, $session);
@@ -391,7 +391,7 @@ sub checksessionexpiry ($$) {
if (defined $session->param("name")) {
my $sid=$q->param('sid');
- if (! defined $sid || $sid ne $session->id) {
+ if (! defined $sid || $sid ne $session->id || ! length $session->param("name")) {
error(gettext("Your login session has expired."));
}
}
@@ -444,11 +444,11 @@ sub cgi (;$$) {
}
# Auth hooks can sign a user in.
- if ($do ne 'signin' && ! defined $session->param("name")) {
+ if ($do ne 'signin' && ! length $session->param("name")) {
run_hooks(auth => sub {
shift->($q, $session)
});
- if (defined $session->param("name")) {
+ if (length $session->param("name")) {
# Make sure whatever user was authed is in the
# userinfo db.
if (! userinfo_get($session->param("name"), "regdate")) {